.gitlab-ci.yml

include:
  - project: 'AgileFactory/Witboost.Mesh/witboost.Mesh.CI'
    ref: 'main'
    file: 'common/witboost.helm.gitlab-ci.yml'
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml
  - template: Jobs/Container-Scanning.gitlab-ci.yml

image: maven:3.9-eclipse-temurin-17

variables:
  MAVEN_CLI_OPTS: "-s settings.xml --batch-mode"
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"

cache:
  paths:
    - .m2/repository/

stages:
  - setup
  - compile
  - test
  - coverage
  - package
  - publish

setup:
  stage: setup
  extends: .witboost.helm.base-job
  cache: []
  before_script: []
  script:
    - !reference [.witboost.helm.clone-scripts, script]
    - !reference [.witboost.helm.get-version, script]
    - echo "VERSION=${VERSION}" >> vars.env
    - echo "PROVISIONER_VERSION=${VERSION}" >> vars.env
  artifacts:
    reports:
      dotenv: vars.env

sast:
  stage: setup
  cache: []
  artifacts:
    paths:
      - gl-sast-report.json
    reports:
      sast: gl-sast-report.json

secret_detection:
  stage: setup
  cache: []
  artifacts:
    paths:
      - gl-secret-detection-report.json
    reports:
      secret_detection: gl-secret-detection-report.json

fail_on_detection:
  needs:
    - semgrep-sast
    - secret_detection
  before_script:
    - apt update -y && apt -y install jq
  script:
    - ls -a
    - jq '.vulnerabilities[] | .severity' gl-sast-report.json | grep 'High\|Critical' && echo 'Vulnerabilities found in gl-sast-report.json' && exit 1 || true;
    - jq '.vulnerabilities[] | .severity' gl-secret-detection-report.json | grep 'High\|Critical' && echo 'Vulnerabilities found in gl-secret-detection-report.json' && exit 1 || true;
    - echo 'No serious vulnerabilities found.'
  rules:
    - if: $CI_COMMIT_BRANCH
      exists:
        - '**/*.py'
        - '**/*.js'
        - '**/*.jsx'
        - '**/*.ts'
        - '**/*.tsx'
        - '**/*.c'
        - '**/*.go'
        - '**/*.java'
        - '**/*.cs'
        - '**/*.html'
        - '**/*.scala'
        - '**/*.sc'

vulnerability_analysis:
  stage: compile
  before_script:
    - mvn --version
  script:
    - mvn -DskipTests=true package org.owasp:dependency-check-maven:check
  artifacts:
    when: always
    paths:
      - report/target/dependency-check-report.html

license_check:
  stage: compile
  before_script:
    - mvn --version
  script:
    - mvn -DskipTests=true package licensescan:audit
  artifacts:
    when: always
    paths:
      - collibra-data-catalog-plugin-server/target/license-scan-results/index.html
      - collibra-data-catalog-plugin-server/target/license-scan-results/license-scan-report.json

linter:
  stage: compile
  before_script:
    - mvn --version
  script:
    - mvn checkstyle:check
    - mvn spotless:check

compile:
  stage: compile
  script:
    - mvn $MAVEN_CLI_OPTS compile

test-jdk17:
  stage: test
  script:
    - mvn $MAVEN_CLI_OPTS org.jacoco:jacoco-maven-plugin:prepare-agent test jacoco:report-aggregate
    - cat report/target/site/jacoco-aggregate/index.html | grep -o '<tfoot>.*</tfoot>'
  coverage: '/Total.*?([0-9]{1,3})%/'
  artifacts:
    when: always
    paths:
      - report/target/site/jacoco-aggregate/jacoco.xml

coverage-jdk17:
  stage: test
  image: registry.gitlab.com/haynes/jacoco2cobertura:1.0.9
  script:
    - jacoco_paths=`find * -path "**/src/main/java" -type d | sed -e 's@^@'"$CI_PROJECT_DIR"'/@'`
    - python /opt/cover2cover.py report/target/site/jacoco-aggregate/jacoco.xml $jacoco_paths > report/target/site/cobertura.xml
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: report/target/site/cobertura.xml
  needs:
    - test-jdk17

package:
  stage: package
  script:
    - mvn $MAVEN_CLI_OPTS package spring-boot:repackage
  artifacts:
    paths:
      - collibra-data-catalog-plugin-server/target/*.jar

publish:
  stage: publish
  script:
    - mvn deploy -s ci_settings.xml

docker_build:
  stage: publish
  image: docker:23.0.0
  services:
    - docker:23.0.0-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$VERSION .
    - docker push $CI_REGISTRY_IMAGE:$VERSION

helm_package:
  stage: publish
  extends: .witboost.helm.deploy
  needs:
    - docker_build

container_scanning:
  stage: publish
  variables:
    GIT_STRATEGY: fetch
    CS_DOCKERFILE_PATH: .
    CS_IMAGE: $CI_REGISTRY_IMAGE:$VERSION
  needs:
    - setup
    - docker_build
  dependencies:
    - setup

check_vulnerabilities_analysis:
  stage: publish
  before_script:
    - apt update -y && apt -y install jq
  script:
    - ls -a
    - jq '.vulnerabilities[] | .severity' gl-container-scanning-report.json | grep 'High\|Critical' && echo 'Vulnerabilities found in gl-container-scanning-report.json' && exit 1|| true;
    - jq '.vulnerabilities[] | .severity' gl-dependency-scanning-report.json | grep 'High\|Critical' && echo 'Vulnerabilities found in gl-dependency-scanning-report.json' && exit 1|| true;
    - echo 'No serious vulnerabilities found.'
  needs:
    - container_scanning
  rules:
    - if: $CI_COMMIT_BRANCH